UAC-0185Threat actor
- UNC4221
UAC-0185 has been active since at least 2022, primarily targeting Ukrainian defense organizations through credential theft via messaging apps like Signal, Telegram, and WhatsApp, as well as military systems such as DELTA, TENETA, and Kropyva.From MISP Galaxy
Last reported 27 days ago, by CERT-EU1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“On June 8, WhatsApp reported it caught and disrupted Israel-based NSO Group-linked spearphishing and social engineering attempts targeting users globally.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Brief 26-07 - June 2026“…ns allegedly used for China-linked intelligence collection, and placed a bounty on operators of Russia-linked threat actors UNC5792 and UNC4221.”
Thanks — we review every report.